AI, LLMs, and AI slop (culture + security + tooling)
- LLMs are destroying art: the art of code, literature, and culture.
- wtf is NS_ERROR_INVALID_CONTENT_ENCODING? investigating shared dictionaries and ChatGPT breakage in Firefox
- From gixy-ng to Gixy-Next: rescuing Gixy from AI slop
- Another AI slop story: ChatGPT vs. Human
- AI slop security engineering: Okta’s nextjs-auth0 troubles
- Retrospective: AI-powered security engineers and source code scanners
- Hacking with AI SASTs: An overview of “AI Security Engineers” / “LLM Security Scanners” for Penetration Testers and Security Teams
Nginx, Gixy-Next, ReDoS, and regex security
- Gixy-Next: an overview of a Gixy fork with updated, improved, and new checks
- Identifying ReDoS Vulnerabilities in Nginx Configurations Using Gixy-Next
- Can Nginx Configurations Be Vulnerable to ReDoS Expressions?
- A Comparison of Tools to Detect ReDoS-vulnerable Expressions
- Securely Validating Domain Names with Regular Expressions
- proxy_pass: nginx’s Dangerous URL Normalization of Paths
- nginx “allow” and “deny” directives with “return”
- nginx’s proxy_pass DNS caching problem
Web platform, browsers, feeds, and HTTP/TLS debugging
- Debugging failures of HTTP/2 in Burp, mitmproxy, and browsers
- Extracting TLS Session Keys in Burp Proxy a la SSLKEYLOGFILE
- One-Way Sandboxed Iframes: Creating a Read-Only Iframe Sandbox That Can’t Read Back
- Feedburner’s Caching Problem
- wtf Google: cacheable rss feeds are dead, and Atom feeds are delayed
- Firefox now automatically trusting the operating system’s root store for TLS certificates - update: it does so only for user-added ones
- Slack login is broken with noscript
FreeBSD, Macs, and hardened networking
- A Full Guide: FreeBSD 13.3 on a MacBook Pro 11.4 (Mid 2015) (A1398)
- Webcam support on a Macbook running FreeBSD using PCI passthrough
- BCM43602: Debugging a Wifi chipset causing a whole-system hang with FreeBSD’s bhyve VM
- Encrypted DNS over TLS on FreeBSD with Unbound, and Blocking Unencrypted DNS Traffic
- An automatic captive-portal resolver and DNS white-lister for DNS over TLS with Unbound
- Encrypted NTP using NTS and chrony on FreeBSD
- Updating FreeBSD’s datetime without DNS
- Mounting and reading an ext4 drive on MacOS
- Swapping/Remapping the silcrow (S) key for a tilde on international Macbooks
- Exclusive i3 keysyms for specific programs. or: Binding Escape on imagemagick’s import
- Cute color progression for my battery status indicator
Fuzzing and vulnerability research (AFL++, harnessing, corpora)
- Fuzzing scripting languages’ interpreters’ native functions using AFL++ to find memory corruption and more
- Automatically Generating a Well-Tuned Fuzzing Campaign With AFL++
- Fuzzing with memfd_create(2) and fmemopen(3)
- Fuzzing glibc’s libresolv’s res_init()
- Fuzzing with multiple servers in parallel: AFL++ with Network File Systems
- Attacking a scripting language’s cryptographic functions with Wycheproof
SSH, LDAP, and internal-network offensive engineering
- SSH-Snake: Automatic traversal of networks using SSH private keys
- SSH-Snake Update: Multi-IP Domain Resolution
- Achieving persistence with a hidden SSH backdoor
- SSH Adventures Continued: Invalid CVE-2018-15473 Patches
- Playing with SSH: carriage returns on stderr output
- Bash and SSH fun: SSH is eating my stdin! Or: why does my Bash script not continue after returning from a function?
- More fun with bash: bash, ssh, and ssh-keygen version quirks
- Dumping bash variable values from memory using gdb
- LDAP Watchdog: Real-time LDAP Monitoring for Linux and OpenLDAP
- Tracking a secret LoginTime LDAP attribute with Operational Attributes
- Nagios Plugins: Hacking Monitored Servers with check_by_ssh and Argument Injection: CVE-2023-37154
- Describing All Kubernetes Pods of All Namespaces for Fun and Profit
- Stealing All of Hashicorp Vault’s Secrets Using Login Enumeration
Big writeups: incidents, vulns, audits, and DoS
- 55 Vulnerabilities in Squid Caching Proxy and 35 0days
- CVE-2023-4863: Fallout hits Facebook; probably much much more
- How to DoS MySQL/MariaDB and PostgresSQL Servers With Fewer Than 55kb of Data
- root with a single command: sudo logrotate
- Supply chain attacks and the many (other) different ways I’ve backdoored your dependencies
- NXDOMAIN’d: Catching unregistered domains for fun and profit
- Network Security: Absurdity of Shared NICs with BMCs and Management Networks
- Bypassing Zscaler, Kandji MDM, and Apple Business Manager for Fun and Lulz
- No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability
- A DoS Attack in RuneScape: In 3-Dimensions!
- Proxy Services, Hijacked Companies, and the Rabbit-Hole of Fake Hosting Companies and Big Sky Services
- Attacking a temperamental ten-year-old Jenkins server
- My 2025 Bug Bounty Stories
- Some Thoughts on “Fixing Security Issues”
Auth, accounts, and credential abuse
- The End of Yubikeys as 2-Factor-Authentication? Google Breaks 2FA with Yubikeys in Favor of Passkeys
- On the Google Account Persistence Exploit
- Credential Stuffing Done Right: Some Tips
- A RuneScape Hacker’s Dream: An Authenticator and PIN Bypass
Programming, tooling, and practical notes
- CCBot: Chrome Checker Bot for Chrome Security Releases
- body: A bash script to get the middle of a file, instead of head | tail
- ipgrep: grepping for ip addresses
- Breaking decompilers with single-function, and no-main() C codebases
- Flattening Arrays, Tail Call Recursion, and Stack Overflows in JavaScript
- A small solution to DNS rebinding in Python
- NodeJS, nvm, yarn, and npm on MacOS in 2025
- CodeQL on MacOS
- Comparing different versions of AWK with WebAssembly
- Crawling every Debian .deb package in history from snapshot.debian.org, learning the .deb format, and finding rate-limiting bypasses
- Creating an eBay crawler for fun and profit
Recon and scanning
- 5 Tips For Port Service Scanning 16x Faster: Part 1
- Speeding up nmap service scanning 16x
- Improve nmap’s service scanning with this 1 weird trick!
Personal essays, travel, and culture series
- A helicopter story
- POV: You land at Melbourne Airport
- On being an illegal immigrant, hacking an unlimited Schengen visa, and becoming Polish
- On Iranian Censorship, Bypasses, Browser Extensions, and Proxies
- Losing Sight and Vision of Your Mission and Culture
- Losing Sight and Vision of Your Mission and Culture: Part 2
- Losing Sight and Vision of Your Mission and Culture: Part 3
- Losing Sight and Vision of Your Mission and Culture: Part 3.5
- Revisiting My Old Blog
- Revisiting the past: Security recommendations of a 17-year-old Joshua
- My Wroclaw tourism tips and recommendations
- How I got into the security industry
- Hello, Kafka Support Here, How Can I Help You? GitHub Edition
- On using private browsing mode for half a year